That is not uncommon right now. In fact, one of the most common hacking rackets is to say 'we have your data and we will not expose it in exchange for cash'. After all, asking for a lump sum of $X00,000 is a lot more secure and pays a lot better than trying to market that data (without getting caught). It seems like the changes you're suggesting are, they lower the stakes (less ransom, but less data revealed), and if you pay up they tell you what the vulnerability is. Regardless, they are definitely NOT grey hat at that point.

It is much kinder, but generally it's also much more economically sensible. If you crack Pepsi's servers, the information on there is really only going to be valuable to one or two other entities (namely, Coca Cola). But selling to them is tough; you have to convince them you have this data without showing it, convince them it's of value (and of as much value as you say it is), convince them to play dirty rather than turn to Pepsi and just say 'hey, we don't support this behavior, let's work together to catch these crooks', and hope that Coke is in a place where they can actually use that data. If any of that falls through, all your work is for nothing. Plus of course, once you sell that data, you can't sell it again. Compare that to the other situation of threatening Pepsi. You don't need to convince them as much that you have valuable data, because their fear is going to be greater than their greed and just a little bit of throw-away information can suggest much worse. You don't need to keep from showing it either. You don't need to convince them to play dirty. You don't need to hope Coke can leverage the data or will play dirty because Pepsi doesn't know either. The Coke exec involved stands to make a bonus, but the Pepsi exec stands to lose his job. In fact, the bonus to Coke from the additional data has less economic value than the penalty to Pepsi (since they suffer the loss of sales PLUS the loss of investor faith). Plus, the trick is repeatable indefinitely. Playing against multiple corps, say you have Ford data you're trying to sell to Honda, Toyota, GM and Hyundai, still makes things more complex and generally the value of the data goes down the more people you're sharing it amongst. So it's tough. Plus of course, the risk of capture goes up as well. Only rarely does it make more economic sense to make the first offer to the competitor rather than to blackmail the loser. If you want to make your group special, I'd try to think outside of the economic mold. If they're doing it for lulz, why are they asking for money at all? Why can't they swap it for favors, and pull those favors to do dirty stuff against other parties? Or perhaps they really do just hack systems and play practical jokes (for instance, changing Pepsi's site to say it's made with swamp water). That's not very common in our modern society because the cost of cracking a system and keeping it cracked for any amount of time is high, and the profit is usually low. But in a reputation economy, someone who can keep some web defacements up for a month or two are looking at some MAJOR rep boosts, and that translates to wealth.

Quote:

Each hypercorp maintains a contract with a chosen Grey Hat crew. For a nominal fee, this Grey Hat crew puts your computer resources on a list of networks that the Grey Hats regularly attempt to hack into. Since this is a business arrangement, there is the implicit understanding that any embarrassing secrets would be strictly confidential, but that the client would be mocked openly for their shameful and lax information security.

If I remember correctly, the movie 'Sneakers' had the protagonists doing something similar except they did one job at a time and didn't do the pointing and laughing. I think the term for it is a "Tiger Team".

root wrote:

The given hypercorp wouldn't want to pay the grey hats; this is pure extortion.

Um... no. These guys break up strikes by rewiring the brains of trade unionists. The settle mineral rights disputes by sending in mercenaries with more firepower than a panzer division. You're basically trying to run an extortion racket on Keyser Söze here.